I am executing an ARM template which create an Azure Kubernetes Service and other resources from an Azure resource group deployment task.

My ARM template have as a parameters servicePrincipalClientId and servicePrincipalClientSecret sensitive data, which are used to create the Azure Kubernetes cluster, just right here. (This link is my complete ARM template)

So, that I am doing is the following:

• I've created the servicePrincipalClientId and servicePrincipalClientSecret as pipeline variables

• I previously create the service principal and its servicePrincipalClientId and servicePrincipalClientSecret data, I am using them to create a service connection in order to connect to Azure cloud of this way:

• I have a PowerShell task to convert the servicePrincipalClientId and servicePrincipalClientSecret variable values as a secure strings of this way:

$env:secretServicePrincipalClientId = ConvertTo-SecureString '$($env:servicePrincipalClientId)' -AsPlainText -Force

$env:secretServicePrincipalClientSecret = ConvertTo-SecureString '$($env:servicePrincipalClientSecret)' -AsPlainText -Force

• To Deploy the resources defined in the ARM template I've created an Azure resource group Deployment task with the following options:

• I am using the service connection created to interact with my subscription.

• Action to be performed: Create or Update resource group

• Template, the ARM template path referenced above.

• Override template parameters I included here all the ARM template parameters values and I want to emphasize here the way how I am referencing the servicePrincipalClientId and servicePrincipalClientSecret variable values:

I am referencing here the secretServicePrincipalClientId and secretServicePrincipalClientSecret variables that I used to convert servicePrincipalClientId and servicePrincipalClientSecret variable values as a secure strings above in my first azure devops task

-servicePrincipalClientId $($secretServicePrincipalClientId) 
-servicePrincipalClientSecret $($secretServicePrincipalClientSecret) 
   .
   .
-serviceCidr "100.0.0.0/16" 
-dnsServiceIP "100.0.0.10" 
-dockerBridgeCidr "172.17.0.1/16" 
   .
   .

So, when I execute the release pipeline, I got this error in the Azure resource group deployment task

2019-10-26T20:05:13.3246017Z The detected encoding for file 'd:\a\r1\a\Project\Deployments\ARMTemplates\Infrastructure\AzResourceGroupDeploymentApproach\testing.json' is 'utf-8'
2019-10-26T20:05:13.3410693Z Starting Deployment.
2019-10-26T20:05:13.3412081Z Deployment name is AzureDevOpsDeployment


2019-10-26T20:05:18.1729784Z There were errors in your deployment. Error code: InvalidTemplateDeployment.
2019-10-26T20:05:18.1730624Z ##[error]The template deployment 'AzureDevOpsDeployment' is not valid according to the validation procedure. The tracking id is 'xxxxxxx'. See inner errors for details.
2019-10-26T20:05:18.1731223Z ##[error]Details:


2019-10-26T20:05:18.1732062Z ##[error]ServicePrincipalNotFound: Provisioning of resource(s) for container service KubernetesCluster-aks in resource group testing failed. Message: {
  "code": "ServicePrincipalNotFound",
  "message": "Service principal clientID: $($secretServicePrincipalClientId) not found in Active Directory tenant ***, Please see https://aka.ms/aks-sp-help for more details."
 }. Details: 

2019-10-26T20:05:18.1733305Z ##[error]Task failed while creating or updating the template deployment.
2019-10-26T20:05:18.1765718Z ##[section]Finishing: Azure Deployment:Create Or Update Resource Group action on testing

Looks like the service principal that I am using to connect to Azure cloud does not exist, but that's not true. That service principal exist.

If I include directly in plain text in the task the servicePrincipalClientId and servicePrincipalClientSecret values

-servicePrincipalClientId <servicePrincipalClientId-value> 
-servicePrincipalClientSecret <servicePrincipalClientSecret-value> 

The Azure resource group task works and the resources in the ARM template are deployed in Azure cloud from Azure DevOps.

• What the problem is?

According to this link AKS need a service principal to be created.

• Also when we create an Azure Kubernetes Service using az cli the service principal is created automatically.

• The same case happens when we create an Azure Kubernetes Service from Azure portal.

So I am creating an Azure Kubernetes Service from Azure Devops executing an ARM template via resource group deployment task using an existing Service principal credentials in the task and in the service connection.

• Why my service principal is not recognized?

I try this option to troubleshoot and solve the problem, but I afraid that the problem is not the service principal itself, instead of it, I think I would need to reference the - servicePrincipalClientId $($secretServicePrincipalClientId) and
-servicePrincipalClientSecret $($secretServicePrincipalClientSecret) of an special way.

How can I do that?

If someone can point me in the right direction I would appreciate